Investigators use iPhones to track owners’ movements

Share this:

David Rietdorf of San Jose makes his first phone call after buying an iPhone 4 at the downtown Los Gatos Apple Store on June 24, 2010. Rietdorf and his brother were the first in line. (Gary Reyes/Mercury News)

That iPhones and other Apple (AAPL) handheld gadgets keep track of their users’ movements may have been news to most users when it was publicly disclosed on Wednesday. But it wasn’t news to investigators who examine cellphones and other electronic devices for clues in criminal and other legal cases.

Those investigators — and the software developers who make applications they use in their work — have known since at least last year that the iPhone has a hidden file on it that tracks its movements. Data gleaned from the file has been used in numerous investigations since forensics experts discovered it, those experts say.

“I’ve analyzed so many iPhones I’ve lost track,” said Christopher Vance, a digital forensics specialist at Marshall University’s Forensics Science Center, which works with law enforcement officials investigating crimes in its home state of West Virginia. Using the iPhone’s tracking file “is part of the standard analysis for me,” he added.

Privacy advocates warned that the file — and its use — has profound implications for owners of Apple handheld products.

“Apple has unwittingly or knowingly become complicit in a wide range of mobile surveillance,” said Jeff Chester, executive director of the Center for Digital Democracy, a consumer privacy advocacy group.

The tracking file has also caught the attention of lawmakers. Sen. Al Franken, D-Minn., and Rep. Ed Markey, D-Mass., separately sent letters to Apple CEO Steve Jobs asking for more information about the file and what, if anything, Apple itself does with the data.

The tracking file came to the attention of the general public on Wednesday, when two researchers at the Where 2.0 conference in Santa Clara announced their discovery of it. The file, which can be found on all Apple devices running the latest version of its mobile iOS operating system, contains the latitude and longitude of cellphone towers and Wi-Fi access points with which those devices have interacted.

Apple has yet to offer an explanation for the file and did not return calls seeking comment. In a letter to Markey and Rep. Joe Barton, R-Texas, last year, Apple general counsel Bruce Sewell said that iOS devices regularly collect and transmit to Apple data about cell tower and Wi-Fi locations “to help Apple maintain and update its database” of location-based information. But that letter made no mention of a hidden file on Apple’s devices.

Sean Morrissey, CEO of Katana Forensics, said he discovered early last year that Apple devices running iOS 3, the then-current version of the operating system, were logging their locations over time. With iOS 4, which came out last summer, Apple moved, renamed and reformatted the log file and began backing it up on users’ computers, he said. The changes made the tracking file more accessible to forensics researchers.

Katana has developed an application called Lantern that it offers to companies and law enforcement agencies “from the federal to the local level” for use in gleaning data from iOS devices, Morrissey said. As early as May or June, Katana had developed a software tool that it used internally to access the iOS tracking file for clients for which it consulted, he said. The company included a version of that tool with the new version of Lantern it released in January, he said.

Katana consults on about a dozen cases a month and regularly uses the location tool in Lantern to find out where particular iOS devices have been, Morrissey said. Cases the company has consulted include missing-person cases and custodial kidnappings, he said.

Likewise, Access Data, which offers similar software for examining cellphones, has been gleaning data from the iPhone’s tracking file “for quite some time” said Lee Reiber, the company’s director of mobile forensics. The data gleaned from cellphone towers doesn’t give a precise location of where an iOS device was at any one point, but it often will say what side of a tower the device was connected to, which can help investigators zero in on a device’s coordinates, he said.

“It’s fantastic data,” he said.

Reiber said similar data can be gleaned from some other brands of mobile devices, particularly those running applications that provide information based on the users’ location. Such applications often keep a log of where users have been in the past, he said.

“It’s not just (Apple) iDevices,” he said.

In a related development, The Wall Street Journal reported Thursday that phones running Google’s (GOOG) Android operating system collect location data every few seconds and send that data to Google several times an hour. There’s no indication, though, that the location data is stored permanently on users’ phones.

Cellphone service providers also have records of the locations of individual cellphones. But Morrissey said it’s easier for law enforcement officials to get the data directly from users’ cellphones, because acquiring it from the service providers requires a separate subpoena.

“They already have access to the phone,” he said.

Morrissey and other forensics experts said they only gleaned the tracking data from iPhones and other devices legally, either via a search warrant or with the device owners’ consent.

But the fact that they were able to glean it at all should raise a warning flag for users of Apple’s iOS devices and users of other devices with similar features, privacy experts said.

“Whatever the engineering explanation for this, if there is one, it’s critically important that consumers be aware of this kind of tracking and, to the extent possible, be given a choice of whether they want this kind of file on their system,” said John Morris, general counsel at the Center for Democracy and Technology.

Contact Troy Wolverton at 408-920-5021. Follow him at http://twitter.com/troywolv.

Troy Wolverton writes the Tech Files column and covers consumer technology as the personal technology columnist for the Bay Area News Group. Previously, he covered Apple and the consumer electronics industry. Earlier, he reported on technology, business and financial issues for TheStreet.com and CNET News.com.